tls: add --tls-cipher-list command line switch#2412
Closed
jasnell wants to merge 1 commit into
Closed
Conversation
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This adds a new
--cipher-listcommand line switch, andcorresponding
NODE_CIPHER_LISTenvironment variable,that can be used to override the built-in default cipher
list. The intent of this is to make it possible to enforce
an alternative default cipher list at the process level.
Overriding the default cipher list is still permitted at
the application level by changing the value of
require('tls').DEFAULT_CIPHERS.As part of the change, the built in default list is moved
out of tls.js and into node_constants.h and node_constants.cc.
Two new constants are added to require('constants'):
DEFAULT_CIPHER_LISTdefaultCipherList(the active default cipher list)DEFAULT_CIPHER_LIST_COREdefaultCoreCipherList(the built-in default cipher list)A test case and doc changes are included.
A new NODE_DEFINE_STRING_CONSTANT macro is also created in
node.h
When node_constants is initialized, it will pick up either
the passed in command line switch or envvar value or fallback
to the default built in suite.
Within joyent/node, this change had originaly been wrapped
up with a number of other related commits involving the
removal of the RC4 cipher. This breaks out this isolated
change.
/cc @mhdawson, @misterdjules, @trevnorris, @indutny, @rvagg